1. Field of the Technology
The present invention relates to network authentication techniques, and particularly to a method for implementing CDMA2000 HRPD user authentication in multi-mode networks including IS95/CDMA2000 1x and CDMA2000 HRPD by using the original Mobile Switching Center (MSC)/Visiting Location Register (VLR) and Home Location Register (HLR)/Authentication Center (AC) in the IS95/CDMA2000 1x system.
2. Background of the Invention
CDMA is an advanced technology of digital cellular mobile communications and one of the most important radio transmission technologies (RTT) of 3G accepted by the International Telecommunications Union (ITU). Since the first release of CDMA standards by QUALCOMM Incorporated in 1990, there have been two important stages in the evolution of CDMA technology.
As shown in FIG. 1, the network architecture of CDMA2000 1x consists of Mobile Station (MS), Base Transceiver Station (BTS), Base Station Controller (BSC), Packet Control Function (PCF), Packet Data Service Node (PDSN), Authentication, Authorization, Accounting server (AAA), and IS-41 core network, where IS-41 core network includes MSC, VLR, HLR, and AC.
User authentication in CDMA IS95 and CDMA 2000 1x networks is completed jointly by MSC/VLR and HLR/AC. Moreover, the Shared Secret Data (SSD) are stored in a terminal and HLR/AC as one of the input parameters for authentication while identical keys for authentication (A-key) are stored in the terminal and HLR/AC specially for use in updating SSD. When authentication is needed, the authentication result is calculated by the algorithm of Cellular Authentication and Voice Encryption (CAVE) with the parameters of SSD, random number, Electronic Serial Number (ESN), and Mobile Station Identity Number (MIN), then MSC/VLR or HLR/AC will compare the authentication result to check whether it is consistent or not; if not consistent, the system will initiate an updating of SSD. After the updating of SSD is successful, i.e. the SSD at the terminal side and SSD at the network side are consistent, next authentication will be successful only when the authentication result calculated by the user with SSD is consistent with the authentication result calculated by HLR/AC.
CDMA 2000 HRPD (CDMA 2000 1xEV-DO), simplified as HRPD, is an upgraded technology of CDMA 2000 1x, providing high-rate packet data service with the single-user downstream rate up to 2.4 Mbps.
As shown in FIG. 2, the networking architecture of HRPD consists of Access Terminal (AT), Access Network (AN), AN AAA, PCF, PDSN, and AAA. User authentication is implemented in an HRPD network mainly by AN AAA. After authentication succeeds, AN AAA will return to AT the International Mobile Subscriber Identity (IMSI) of the terminal for use in later switching and charging processes. In the authentication process of HRPD, the interface A12 between BSC/PCF and AN AAA is used and this interface adopts the Remote Access Dial User Service protocol (RADIUS) with the Password Authentication Protocol (PAP) and Check-Handshake Authentication Protocol (CHAP) as the main authentication mechanisms. Since CHAP has relatively better performance in security, there are more applications of CHAP in authentication.
CHAP adopts the identity authentication algorithm of private-key-based Message Digest (MD). As shown in FIG. 3, take the CHAP protocol as an example and the authentication process through RADIUS protocol specifically includes:
Step 301: AT consults with the network side via PPP/LCP and decides to use CHAP for authentication;
Step 302: AN sends a Challenge message to AT to initiate authentication, and the message contains the random number generated by AN;
Step 303: AT calculates the digest with the random number by means of the encryption algorithm prescribed by CHAP, and then sends the user name and digest to AN via a Response message;
Step 304: AN constructs at Interface A12 an Access Request message of the RADIUS protocol to carry the user name, random number and digest, and sends the message to AN AAA;
Step 305: AN AAA calculates a digest with the random number by means of the same algorithm and judge by comparison whether this digest is consistent with the digest sent up from the terminal, if consistent, the authentication succeeds and AN AAA sends an Access Accept message to AN, otherwise the authentication fails and go to step 302;
Step 306: AN sends a Success message to the terminal, notifying AT that the authentication is successful.
It can be seen from the above process that authentication of HRPD users in the prior art requires the use of AN AAA and the authentication is a one-way process.
At present, along with the development of market economy and technology, more and more operators desire to operate simultaneously various networks. For example, an operator of IS95/CDMA 2000 1x network would like to expand its service to CDMA 2000 1xDO network while authentication in CDMA 2000 1xDO requires setting up of a special AN AAA for authentication. For a user having subscribed to various CDMA networks simultaneously, this approach of authentication requires opening accounts at both HLR and AN AAA, making authentication modes not unified and maintenance inconvenient, which is not conducive to unified operation. Moreover, this approach requires a special nationwide network of AN AAA for HRPD user authentication, resulting in high cost in network construction.
In addition, as Wireless Local Area Network (WLAN) and CDMA networks are complementary, traditional operators of CDMA mobile networks are considering providing WLAN access service. As WLAN and CDMA IS95/CDMA 2000 1x are two independent types of networks, account-opening and maintenance of the two types of networks are independent, and so are the authentication mechanisms. Therefore, more AAAs are required in authentication implementation and each AAA must be able to interface with other AAAs, which requires a special roaming network to be set up between WLAN and AAA to implement roaming operation, resulting in high cost of network construction.